That's an excellent explanation. It also fits the mold of just about every other "service X broke into service Y and stole my info" story, wherein people forget lots of other plausible explanations.
And a good lesson as to why you should never make unannounced changes to your user's data. They will think you "broke" something, even if it never worked the way they thought it did.
